Live › vulnerability › CVE-2026-58268
Go to dashboardsipgo is a Go library for building SIP services, and its stream parser allocates a body buffer based on the client-declared Content-Length before checking the maximum message length. An unauthenticated remote peer can send a single oversized message over TCP, TLS, WS or WSS and make the process allocate large amounts of memory, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product |
|---|
| Ecosystem |
|---|
| Affected |
|---|
| Fixed in |
|---|
| github.com/emiago/sipgo | go | < 1.4.1 | 1.4.1 |
Check whether go.mod lists github.com/emiago/sipgo below v1.4.1 (run: go list -m github.com/emiago/sipgo).
Upgrade github.com/emiago/sipgo to v1.4.1 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transport message over TCP, TLS, WS, or WSS with an oversized declared length, causing excessive memory allocation and denial of service before the body is read. This issue is fixed in version 1.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-58268")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.